This page explains what happens to personal data on falsmount.com, as required by Articles 13 and 14 of the GDPR. In short: the site shows a product and, depending on the model, either takes a real order through Stripe or — while payment is still closed — an optional notification email.

Who is responsible

The controller is OÜ MARTOSE HOLDING, Pelguranna tn 59-28, 10316 Tallinn, Estonia (registry code 10888736). Questions about your data go tohello@falsmount.com. We have not appointed a data protection officer — we are not required to.

The order pages

The product pages let you pick a size and quantity — and for the XL, the seam step it would be built to — and go to a checkout. The checkout asks for a delivery country. What happens after that depends on whether that model is open for real orders yet — both paths are described below, and only one of them applies to any given order.

If the model is open for real orders: choosing your country and continuing takes you to Stripe Checkout, hosted by Stripe. You enter your payment details directly with Stripe — we never see or store your card number. Stripe passes back to us what we need to fulfil the order: your email address, your shipping address, your phone number (for delivery by the carrier), which model and quantity you bought, and the seam step you entered if you ordered the XL. Legal basis: performance of the sales contract with you, Art. 6(1)(b) GDPR. How long: for as long as we need the record to fulfil the order and handle any warranty or return, and afterwards for as long as the law requires us to keep accounting records.

Delivery by Omniva. To ship your order, we create a parcel label. For this, we pass the details you entered at Stripe Checkout to the carrier Omniva (AS Eesti Post, Estonia): your name, your delivery address, your email address and your phone number. In Germany, Omniva hands the parcel to a delivery partner, who brings it to you. The partner only receives what it needs for this: name and address, and where needed also phone number or email address. Omniva or its delivery partner may notify you about the delivery status by email or SMS. Omniva keeps the data in line with its own statutory retention obligations. Legal basis: performance of the sales contract with you, Art. 6(1)(b) GDPR.

Which link brought you here. If you arrived through an advertisement or a tagged link, the campaign markers in that link (utm_…, gclid,fbclid) are kept in your browser for the duration of your visit and, if you then place an order, stored with that order in Stripe together with your answer to the analytics banner. This is our own record of which advertising led to a sale — no cookie is set for it and nothing about it is sent anywhere until an order is actually placed. Legal basis: our legitimate interest in knowing which advertising works, Art. 6(1)(f) GDPR. How long: as long as the order record itself.

If the model is not yet open for real orders (no batch has been cut yet): the checkout asks for a delivery country and nothing else — no email address, no name, no address, no payment details.

What you pick on that checkout screen is not sent to us and not stored. It stays in your browser and is used only to fill in the notification form on the next screen. If you close the page there, we have received nothing and we have no way to contact you.

• If — and only if — you then click “Tell me when it ships”: we receive youremail address — that form is the first and only place the site asks for one — the delivery country you picked, which size and quantity you chose, and the seam step if you entered one. That click is the consent; reaching the checkout is not.
• Why: to email you once about that order, and to understand which sizes, seam steps and markets people actually want.
• Legal basis: your consent, Art. 6(1)(a) GDPR.
• How long: until we send that email, or until you ask us to delete it, whichever comes first. Seam measurements may be kept longer in aggregate form that no longer identifies you.
• Withdrawing: reply to any email from us, or write tohello@falsmount.com. Withdrawal does not affect processing that already happened.

Submissions are handled by Netlify, which stores them on our behalf. We do not sell, rent or share this list. Separately, if you have accepted analytics, we record that a checkout could not be completed, along with the size, quantity, seam step and country. That record carries no email address and is not linked to one you may later enter.

Server logs

Our host records ordinary access data — IP address, time, the page requested, browser and referrer — to serve the site and defend it against abuse. Legal basis: our legitimate interest in operating a secure website, Art. 6(1)(f) GDPR. These logs are short-lived and we do not use them to build profiles.

Visit counting without cookies (Plausible)

We use Plausible Analytics on every page to count visits, see which pages are read and record a few steps of the order flow as anonymous events (for example a click on “Buy now”, starting checkout, using the fit check), without anything you type. It runs regardless of the banner below because it needs nothing from your device: it sets no cookie, stores nothing in your browser and does not follow you across sites or devices. Your IP address and browser signature are turned into a hash with a salt that changes daily, and the raw IP address is not kept, so no visitor profile can be built and we cannot recognise you the next day. Plausible is an Estonian company and the data is stored in the EU. Legal basis: our legitimate interest in knowing how many people read this site and which pages, Art. 6(1)(f) GDPR.

Analytics and ad measurement — off unless you say otherwise

We would like to use Google Analytics 4 to count visits and see which parts of the page people read. It is not loaded until you accept it. If you decline, or simply ignore the banner, no Google script is requested, no analytics cookies are set and nothing is sent to Google. Legal basis when you do accept: consent, Art. 6(1)(a) GDPR and the corresponding national ePrivacy rules.

If you accept, the same choice also covers Google Ads conversion measurement and the Meta Pixel from Meta Platforms Ireland Ltd. With both, we see whether our advertisements lead to orders. Google Ads is loaded through the same Google script as Google Analytics and sets the cookie _gcl_au; the Meta Pixel loads a script from Meta and sets the cookie _fbp (each for up to 90 days). With every page view, Google and Meta receive the page requested, your IP address, information about your browser and — if you came from an ad — the click identifier from that link (gclid or fbclid). When you complete an order, we report that purchase to Google and to Meta on the confirmation page: order value, currency, the model and quantity bought, and an order identifier so that a purchase is not counted twice. We do not use the Google Ads data for personalised advertising. Before you accept, neither service is loaded and no cookie is set. If you declined the banner, nothing about you or your order is sent to Google or Meta. We are jointly responsible with Meta for collecting and transmitting the data via the Meta Pixel (Art. 26 GDPR); Meta provides the agreement for this: facebook.com/legal/controller_addendum. Legal basis: the same consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR.

Transfer to the USA: Google and Meta may also process this data in the USA, at Google LLC and Meta Platforms, Inc. respectively. For the USA, the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework applies (Art. 45 GDPR); Google LLC and Meta Platforms, Inc. are certified under this framework. Where a transfer is not covered by it, Google and Meta rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Withdrawal: You can withdraw your consent at any time with effect for the future — through the “Cookie settings” link in the footer of every page or with the button below. If you choose “Decline” there, Google Analytics, Google Ads and the Meta Pixel stop being used at once, and the cookies these services set on our domain (e.g. _ga, _gcl_au, _fbp) are deleted from your browser. This does not affect the lawfulness of processing carried out before the withdrawal.

Change my analytics choice

Fonts and other content

Typefaces are served from our own domain, not from Google Fonts, so viewing the site does not disclose your IP address to a font provider. The 3D model viewer is also served from our own domain. Beyond Plausible and the consent-gated services named above, there are no social media buttons or embedded third-party trackers on this site.

Who else sees your data

Where these providers process data outside the EU, they do so under the European Commission's adequacy decision for the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

Your rights

Under the GDPR you can ask us for a copy of your data (Art. 15), to correct it (Art. 16), to delete it (Art. 17), to restrict how we use it (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you can withdraw it at any time. Write tohello@falsmount.com — we do not charge for this and we will answer within a month.

You can also complain to a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). If you live elsewhere in the EU you may instead complain to the authority for your own country or region.